Freedom of Information Act 2000 Request

Information into data breaches

Your request (in bold and in italics), and our responses appear below:

1. in the 2019/20 year: a) How many personal data breaches (under either the Data Protection Act 2018 or General Data Protection Regulation) were recorded by the CPS? b) How many of these breaches were reported to the Information Commissioner’s Office? c) Were there any instances in which the ICO required the CPS to take action or imposed an enforcement action and, if so, what action was required or taken?

In response to question one, parts a) and b) the Crown Prosecution Service (CPS) is due to publish its data pertaining to financial year 2019/20 and therefore this information is withheld under section 22(1) of the FOI Act - Information intended for future publication. Please see the attached section 17 notice which explains this exemption in further detail.

2. in the 2018/19 year: a) How many personal data breaches (under either the Data Protection Act 1998, the Data Protection Act 2018 or General Data Protection Regulation) were recorded by the CPS? b) How many of these breaches were reported to the Information Commissioner’s Office? c) Were there any instances in which the ICO required the CPS to take action or imposed an enforcement action and, if so, what action was required or taken?

3. in the 2017/18 year: a) How many personal data breaches (under the Data Protection Act 1998) were recorded by the CPS? b) How many of these breaches were reported to the Information Commissioner’s Office? c) Were there any instances in which the ICO required the CPS to take action or imposed an enforcement action and, if so, what action was required or taken?

Data pertaining to financial years 2017/18 and 2018/19, as requested in parts a) and b) of questions two and three is published on the CPS Annual Report and Accounts and is therefore withheld from disclosure under section 21 of the FOI Act – Information accessible by other means. Please refer to the attached Section 17 Notice which explains this exemption in further detail. The CPS Annual Report and Accounts contains data pertaining to all data breaches reported to the Departmental Security Unit (DSU), broken down by breach type and whether the breach was ‘Included or excluded’. Where the explanatory note indicates that the breach was ‘excluded’ on the report, this indicates that the breach was contained.

Data breach information can be located within the Annual Report and Accounts 2018-19 via the link below on page 41.

https://www.cps.gov.uk/publication/cps-annual-report-2018-19

Data breach information for 2017-18 can be located within the Annual Report and Accounts 2017-18 via the link below on page 23.

https://www.cps.gov.uk/publication/cps-annual-report-2017-2018

The Crown Prosecution Service (CPS) does not hold a central record of the information requested in part c) of questions one, two and three. In order to determine whether there was a requirement by the Information Commissioner’s Office (ICO) for action to be taken by the CPS, the subsequent action taken and whether any enforcement actions were imposed by the ICO, a manual review of all ICO referrals during the requested time period would be required.

As a guide, during the three financial years requested, there were a total of 128 ICO referrals made to the CPS.

Section 12(1) of the FOI Act means public authorities are not obliged to comply with a request for information if it estimates the cost of complying would exceed the appropriate limit. The appropriate limit for central government is set at £600. This represents the estimated cost of one person spending 3.5 working days determining whether the department holds the information, and locating, retrieving and extracting the information.

We believe that the cost of manually reviewing 128 referrals would exceed the appropriate limit. Consequently, we are not obliged to comply with your request.

Under section 16 of the FOI Act we have an obligation to advise what, if any, information may assist you with your request. The Information Commissioner’s Office (ICO), publishes information regarding requirements made and any enforcement actions and formal sanctions imposed upon the CPS. This information can be found on their website via the following links:

https://ico.org.uk/action-weve-taken/enforcement/

https://ico.org.uk/action-weve-taken/enforcement/crown-prosecution-service/

Information Management Unit 020 3357 0788 IMU@cps.gov.uk